Zero Radar
← feed
CriticalVulnerabilityCVE-2026-112296updated 25 Oct 2026, 15:20 UTC

FlyCms ships with a known default admin password

FlyCms installs with a built-in administrator account whose password is publicly known. Anyone who knows it can log in as the top administrator and take over the whole website.

Official, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker finds siteFlyCms installation exposed to internet
  2. 2Login request sentPOST /api/auth/login with flycms account
  3. 3Default password usedadmin123 works on unchanged install
  4. 4Admin access gainedOnly image captcha needed to pass
  5. ResultAttacker controls the entire site

What happened

FlyCms through commit edfdf724 includes a default super administrator account 'flycms' with password 'admin123'. The login endpoint POST /api/auth/login only requires solving an image captcha, which does not stop an attacker.

Why it is dangerous: An attacker can gain full control of site content, user accounts and configuration without any prior access. This can lead to defaced or malicious content, stolen user data and a compromised server.

Are you affected?

You are affected if you run FlyCms through commit edfdf724 with the default 'flycms' account and password 'admin123' still in place.

FlyCms through commit edfdf724

What to do

  1. Change the password of the 'flycms' administrator account immediately, or disable or delete the account
  2. Check whether the default admin123 password still works and review admin accounts for unknown additions
  3. Restrict access to the admin login and API endpoints (for example by IP allowlist or VPN) until a fixed version is confirmed
  4. Monitor logs for logins to POST /api/auth/login from unfamiliar sources

Timeline

  1. 19 Oct 2026, 14:17 UTC
    Publicly disclosed
  2. 19 Oct 2026, 14:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 15:20 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-112296 · GHSA-6phq-6cxr-q574
CVSS
9.3 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
19 Oct 2026, 14:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 15:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

FlyCms ships with a known default admin password · Zero Radar